Node.js has rolled out critical security updates for its 26.x, 24.x, and 22.x branches aiming to fix ten vulnerabilities, including four high-severity flaws in TLS certificate checks, DNS name handling, and Brotli decompression. Versions 26.12.1, 24.22.1, and 22.23.4 are the patched builds released today, October 21, 2026.
High-Severity Vulnerabilities You Shouldn’t Ignore
The most serious flaw (CVE-2026-111497) resides in the Brotli decoder across all supported branches. It’s an out-of-bounds write capable of allowing remote code execution, putting any service processing untrusted Brotli content at risk.
Another high-risk issue, CVE-2026-105483, undermines TLS certificate hostname checks when IP addresses use full-width digits, and impacts versions 26.x and 24.x. CVE-2026-106069 introduces a hostname verification bypass tied to loosely resolving hostnames to IPs—this one spans all three branches. Meanwhile, CVE-2026-105482 causes DNS name truncation where names containing a NULL character are mishandled, affecting every supported line.
Other Vulnerabilities & Recommended Actions
Beyond these critical bugs, three medium-severity issues involve HTTP request/response ordering (CVE-2026-105481), improper TLS validation of unusual IPv4 hostnames (CVE-2026-106072), and reuse of cryptographic random values in startup snapshots and single-executable applications (CVE-2026-106074). Low-severity flaws include ZIP header validation failures and filesystem permission bypasses, with some limited to just the 26.x branch.
The update also touches components like c-ares, CA certificates, Undici, OpenSSL, and SQLite—though not all branches have the same exposure.
What You Need to Do Now
Admins should upgrade to the new Node.js versions 26.12.1, 24.22.1 or 22.23.4 depending on which branch they’re using. After updating, rebuild any containers or images, and restart services to ensure fixes are active. Pay extra attention to systems handling HTTPS outbound requests, DNS lookups, compressed Brotli content, and services relying on filesystem permission models.
It’s also crucial to be running on a supported Node.js branch. End-of-life versions—even those patched in this update—remain vulnerable. Migrating away from unsupported versions is essential.
Why this matters: These vulnerabilities aren’t just hypothetical: remote code execution, hostname bypasses, DNS handling flaws—they put applications, APIs, and microservices directly in the crosshairs. Any system receiving external input needs patching now.
